CVE-2020-36934
Published: 25 January 2026
Summary
CVE-2020-36934 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Deepinstinct (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2020-36934 is an unquoted service path vulnerability affecting Deep Instinct Windows Agent version 1.2.24.0. The issue resides in the DeepNetworkService component, where the service path "C:\Program Files\HP Sure Sense\DeepNetworkService.exe" lacks proper quoting. This allows local users to potentially execute arbitrary code with elevated privileges, as the Windows service control manager may resolve spaces in the path by searching subdirectories for a matching executable.
A low-privileged local attacker (AV:L/AC:L/PR:L) can exploit this by placing a malicious executable in one of the intermediate directories along the unquoted path, such as C:\Program.exe or C:\Program Files\HP.exe. When the DeepNetworkService starts or restarts, the service executes the attacker's binary instead of the legitimate one, granting LocalSystem permissions. This results in high-impact confidentiality, integrity, and availability effects (CVSS 7.8), enabling full system compromise from a standard user account.
Advisories and references, including a Vulncheck advisory on the unquoted service path and an Exploit-DB entry (49020) detailing a proof-of-concept, highlight the issue without specifying patches. Vendor pages from Deep Instinct describe the agent as part of HP Sure Sense integration for AI-powered malware protection on HP EliteBook and ZBook PCs.
A public exploit is available on Exploit-DB, indicating potential for real-world local privilege escalation. The affected software provides AI-driven security features, making the vulnerability notable in endpoint protection contexts.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4640
Vulnerability details
Deep Instinct Windows Agent 1.2.24.0 contains an unquoted service path vulnerability in the DeepNetworkService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files\HP Sure Sense\DeepNetworkService.exe to inject malicious code…
more
that would execute with LocalSystem permissions during service startup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in DeepNetworkService directly enables path interception by placing a malicious binary in an intermediate directory (e.g., C:\Program.exe), causing the SCM to execute attacker code with LocalSystem privileges on service start.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of flaws such as the unquoted service path in CVE-2020-36934 through timely patching or reconfiguration.
Mandates secure configuration settings including properly quoted executable paths for services to prevent hijacking via unquoted paths like in CVE-2020-36934.
Vulnerability scanning identifies unquoted service path vulnerabilities such as CVE-2020-36934 for proactive remediation.